Analysis

  • max time kernel
    101s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2022 15:29

General

  • Target

    confinalp.file.26.07.22.docm

  • Size

    3.3MB

  • MD5

    3e43e586ceb8faeb735fe86e8945cd92

  • SHA1

    9e92bc926332cba7e7d00109b6edda386bab2f75

  • SHA256

    ee9f450ad795bd9caf1ad830a3be0ca0c6f3926aa59d8e9fab80e1d48fac2e27

  • SHA512

    dbfc2462f6e9ea197d0d3944dc3c55e8f4fd6a53d8b2dfbc8fd566f10857c2a0094c8bb1b603a268afdd12f2c82d2839e6c2bac558a782653fc234ca20d5bc74

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\confinalp.file.26.07.22.docm"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1544
      • C:\Users\Admin\AppData\Local\Temp\r4A9A.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\r4A9A.tmp.exe" "C:\Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll",DllRegisterServer
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:272

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\r4A9A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Users\Admin\AppData\Local\Temp\r4A9A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll

      Filesize

      1.2MB

      MD5

      a6e0f3c0133c2e7f1444be71562fba03

      SHA1

      ef2b6f395b04e49184466f733c80c7b18225843b

      SHA256

      92acbfa004abecacde2dfd7749bac59e39dfcdcf578ce6c5e3524ba2dfb429c6

      SHA512

      346525aaa03848e3c59fcbb9bc2f5b7eaae1f4f5a5fca0301f12fc907f19e648ba1ae443a5c8993071b3de370aaa80534214006e210880a301ce6b5f6f0fa2c4

    • \Users\Admin\AppData\Local\Temp\r4A9A.tmp.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • \Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll

      Filesize

      1.2MB

      MD5

      a6e0f3c0133c2e7f1444be71562fba03

      SHA1

      ef2b6f395b04e49184466f733c80c7b18225843b

      SHA256

      92acbfa004abecacde2dfd7749bac59e39dfcdcf578ce6c5e3524ba2dfb429c6

      SHA512

      346525aaa03848e3c59fcbb9bc2f5b7eaae1f4f5a5fca0301f12fc907f19e648ba1ae443a5c8993071b3de370aaa80534214006e210880a301ce6b5f6f0fa2c4

    • \Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll

      Filesize

      1.2MB

      MD5

      a6e0f3c0133c2e7f1444be71562fba03

      SHA1

      ef2b6f395b04e49184466f733c80c7b18225843b

      SHA256

      92acbfa004abecacde2dfd7749bac59e39dfcdcf578ce6c5e3524ba2dfb429c6

      SHA512

      346525aaa03848e3c59fcbb9bc2f5b7eaae1f4f5a5fca0301f12fc907f19e648ba1ae443a5c8993071b3de370aaa80534214006e210880a301ce6b5f6f0fa2c4

    • \Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll

      Filesize

      1.2MB

      MD5

      a6e0f3c0133c2e7f1444be71562fba03

      SHA1

      ef2b6f395b04e49184466f733c80c7b18225843b

      SHA256

      92acbfa004abecacde2dfd7749bac59e39dfcdcf578ce6c5e3524ba2dfb429c6

      SHA512

      346525aaa03848e3c59fcbb9bc2f5b7eaae1f4f5a5fca0301f12fc907f19e648ba1ae443a5c8993071b3de370aaa80534214006e210880a301ce6b5f6f0fa2c4

    • \Users\Admin\AppData\Local\Temp\y4A8A.tmp.dll

      Filesize

      1.2MB

      MD5

      a6e0f3c0133c2e7f1444be71562fba03

      SHA1

      ef2b6f395b04e49184466f733c80c7b18225843b

      SHA256

      92acbfa004abecacde2dfd7749bac59e39dfcdcf578ce6c5e3524ba2dfb429c6

      SHA512

      346525aaa03848e3c59fcbb9bc2f5b7eaae1f4f5a5fca0301f12fc907f19e648ba1ae443a5c8993071b3de370aaa80534214006e210880a301ce6b5f6f0fa2c4

    • memory/272-401-0x0000000000000000-mapping.dmp

    • memory/1544-398-0x0000000000000000-mapping.dmp

    • memory/1836-89-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-91-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-61-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-62-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-63-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-64-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-65-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-66-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-67-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-70-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-69-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-68-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-71-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-72-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-73-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-74-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-75-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-76-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-79-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-80-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-78-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-77-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-82-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-81-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-84-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-83-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-87-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-88-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-86-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-85-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-59-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-90-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-93-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-94-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-92-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-60-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-96-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-95-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-97-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-98-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-99-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-100-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-101-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-102-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-103-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-105-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-104-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-106-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-107-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-108-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-112-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-111-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-110-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-109-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-113-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-58-0x0000000070E0D000-0x0000000070E18000-memory.dmp

      Filesize

      44KB

    • memory/1836-57-0x00000000752D1000-0x00000000752D3000-memory.dmp

      Filesize

      8KB

    • memory/1836-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1836-55-0x000000006FE21000-0x000000006FE23000-memory.dmp

      Filesize

      8KB

    • memory/1836-54-0x00000000723A1000-0x00000000723A4000-memory.dmp

      Filesize

      12KB

    • memory/1836-116-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-117-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-115-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-114-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-118-0x0000000000521000-0x0000000000525000-memory.dmp

      Filesize

      16KB

    • memory/1836-414-0x0000000006AD0000-0x000000000771A000-memory.dmp

      Filesize

      12.3MB

    • memory/1836-415-0x0000000002280000-0x0000000002333000-memory.dmp

      Filesize

      716KB

    • memory/1836-416-0x00000000080A0000-0x00000000081D8000-memory.dmp

      Filesize

      1.2MB

    • memory/1836-417-0x0000000070E0D000-0x0000000070E18000-memory.dmp

      Filesize

      44KB

    • memory/1836-418-0x0000000006AD0000-0x000000000771A000-memory.dmp

      Filesize

      12.3MB

    • memory/1836-420-0x0000000070E0D000-0x0000000070E18000-memory.dmp

      Filesize

      44KB